CVE-2026-23876 is a heap buffer overflow (CVSS 8.1) in ImageMagick's XBM image decoder. A crafted image can write past a heap buffer when it is read or identified. ImageMagick 7.1.2-13 and 6.9.13-38 fix it. Upgrade the library and check every service that processes uploaded images.
What's affected
ImageMagick 7 before 7.1.2-13 and ImageMagick 6 before 6.9.13-38. The advisory says any operation that reads or identifies an image can trigger the overflow, which makes image upload and processing pipelines the main concern. Red Hat has published an erratum, RHSA-2026:3058, for its packages.
How to check if you're exposed
Check the installed version:
magick -version
convert -version
dpkg -l | grep -i imagemagick
rpm -q ImageMagick
Then look for indirect use. Many applications call ImageMagick through bindings such as Wand or wrappers in Ruby, PHP, Python and Node. Container images often bundle it too. A dependency scan of your images and repositories will find these.
What to do now
- Upgrade to 7.1.2-13 or 6.9.13-38 or later, or apply your distribution's patched package.
- Rebuild and redeploy container images that bundle ImageMagick.
- Restrict which image formats your upload pipeline accepts. Most web apps do not need XBM. ImageMagick's policy.xml can disable coders you do not use.
- Run image conversion in a sandbox with low privileges and resource limits.
Why it matters
The record lists CWE-122 (heap-based buffer overflow), CWE-190 (integer overflow) and CWE-787 (out-of-bounds write). Decoders for old image formats parse attacker-controlled bytes, and a size calculation that overflows can lead to a buffer that is too small.
Image libraries sit deep inside applications, so teams often do not know they run one. That is why an inventory of dependencies matters as much as the patch. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 8.1, published 2026-01-20. In the vector, the attacker works over the network, needs no account, and the attack is high in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Hardening beyond the patch
Two habits cut the damage from image parser bugs in general. First, resize and convert uploads in a separate, low privilege process or container, with memory and CPU limits and no access to secrets. Second, allow only the formats you need and check the real file type, not the extension. ImageMagick's policy file can disable coders and set limits on memory, map, area, width and height. Keep a list of every place that calls ImageMagick, including libraries that wrap it, so the next update is quick.
Find it across your own code
To see which of your packages are affected, the free in-browser dependency scan at gold.safeguard.sh/scan takes a manifest and lists known vulnerabilities. Reachability analysis then helps you judge whether your code calls the vulnerable path, so you can order the work.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be using XBM files for this to matter?
The decoder is reached when ImageMagick reads a file as XBM. If you accept arbitrary uploads and let ImageMagick detect the format, a file can be presented as XBM. Disabling unused formats in policy.xml reduces that exposure, but the upgrade is the fix.
Sources
Last reviewed: 19 October 2026.
